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Few people realise that data companies 
profile them at every turn. Citizens are 
entitled to expect that public services do 
not allow private companies to surveil them 
on their websites. | hope that this report will 
alert UK citizens to this hazard, and prompt 
reflection at councils across the UK on their 
duty to protect people from surveillance 
capitalism. 


This report should also spur Elizabeth 
Denham, the UK Information 
Commissioner, to enforce the law and force 
data companies to cease the widespread 
broadcast of personal data. It is 17 months 
since evidence from Brave and complaints 
about breaches of data protection laws 
were filed before the ICO. The time to act 
IS NOW. 

Brendan Eich 


CEO & Co-founder, Brave 
February 2020 


This gives these companies enormous 
power. Their profiles of you can be shared 
and sold. This exposes virtually everyone in 
the UK to the threat of profiling, 
manipulation, and discrimination at the 
hands of algorithms. This may determine 
whether an algorithm selects you for your 
next job interview, or perhaps the outcome 
of your next insurance application. 


The effect might be mundane: setting the 


price of the next airline ticket you purchase. 


Or it could be profound: data collectors’ 
dossiers might help political groups try to 
manipulate you with misleading messages. 


Brave is designed to protect you from 
tracking and profiling on all websites. | 
invite you to visit your app store or 
brave.com to install it. Brave is faster, safer, 
and more secure than the alternatives. You 
can use it for free. 


Foreword 


People visit council websites to seek help 
and services. When you have a baby, move 
household, extend your house, get married 
or lose a loved one, UK law requires that 
you register these events with your council. 
Generally, you do so through the council 
website. 


But companies embedded on council 
websites learn about you. This happens 
even on the most sensitive occasions, when 
you might be seeking help from your 
council for a health disability, drug 
problem, or financial distress. 


Companies that you have never heard of 
build dossiers about you. They tie together 
your activity on websites and apps over 
time to calculate what you are interested in 
and what problems you struggle with. In 
short, by spying on your browsing, they can 
understand what makes you tick. 
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councils websites. This applies with varying degrees of severity across the United Kingdom. The UK map (page 4) and tables 
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198 


Councils permit “real-time 
bidding” data breaches. 


409 


Council sites expose visitor 
data to private companies. 


98% 


Councils use Google systems, 
exposing visitors to Google. 


23 


Councils allow data brokers 
to profile their users. 


Key insights 


People in the UK are profiled by multiple companies when they visit council websites 


to register the birth of their baby, move of house, marriage, or a death in the family. 


Nearly all council websites permit at least one company to learn about the behaviour of 
people who visit them. People seeking information about disability, poverty, drugs and 
alcoholism services are profiled by data brokers on some council websites. 


198 council websites in the UK use the "real-time bidding" (RTB) form of advertising. Real- 
time bidding is the biggest data breach ever recorded in the UK. Though illegality is not in 
dispute, the UK Information Commissioner (ICO) has failed to act. 


Google operates systems used behind the scenes on many Council sites. Google owns all 
five of the top embedded elements loaded by council websites, giving it the power to 
know what virtually anyone in the UK views on council sites. 


Over a quarter of the UK population is served by councils that embed Twitter, Facebook, 
and others on their sites, leaking the sensitive issues people read about to these companies. 


6.9 million people are served by councils that allow data broker LiveRamp to track people on 
their sites. Until recently it was part of the Acxiom Group, which sold data to Cambridge 
Analytica. 


None of the data collecting companies recorded in this study had received consent from 
the website visitor to lawfully process data. 


Data leakage from council websites is a "data breach", under Article 5(1)f of the GDPR. 
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Council Data Leaks Map. 


Number of private company data 
collectors discovered on council websites 
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Council Website 


Advertising 
Google verification 
companies 

Other advertising Social & research 
technology companies including 


Twitter and Facebook 


“Real-time bidding” 


i ۱ Data brokers 
advertising auctions 


Unknown Unknown 


Your data trail 


Every single time you load a web page, private companies 
receive the following data from any council websites that 
they are embedded on: 


The URL (address) of each page you visit. This can reveal 
sensitive things about you. For example, visits to a council page 
to apply for school places, or find school term dates, suggests 
you are a parent. If your child has a disability, you might visit the 
specific council page where you can apply for a disabled parking 
permit at your child's school. Similarly, the URLs of council pages 
for senior citizen parking, free public transport, home care, etc. 
reveal one's circumstances. 

ID codes that are specific to you, and that identify you as the 
person who loaded a specific page at a specific time. 

Your location. 

Your device's details, including its type, web browser and 
version, operating system and version, and in some cases the 
apps being used, screen resolution and preferred language. 
Your IP address (not always included in a real-time bidding 
broadcast). 

These ID codes, timestamp, and device details allow private 
companies to tie what you do on one website or app together 
with what you view across the Internet. 
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Big councils with the most trackers 


The findings The bottom line 


۱ l In the private sector, advertising is a legitimate and useful method of 
e Many large councils (serving 300,000 or more people) expose 


0 A | | | | raising revenue. However, online advertising often uses tracking and 
Citizens visiting their websites to extensive tracking and data 


profiling, even though this is not necessary to show useful ads. The 


collection by private companies. 5 ٦ ٰ ۱ 
y P P result is a dangerous data "free for all” in which websites compete to 


e The most egregious examples involve 25 data collectors load the most trackers onto their pages. The councils serving the 
operated by private companies on a single council website. most people appear to expose visitors to the most severe risk. 


Number of trackers on larger council websites 


25 25 Councils serving 300,000+ people, with 7+ data collectors 
Enfield Sheffield City 23 9 
| 22 orave 
pu Wirral 20 
Wandsworth 
T 16 
Sandwell 13 

Newcastle 13 12 

upon Tyne 2+011 Goyder 1 7 10 
86 
Redbridge 8 8 8 


Gloucestershire Lincolnshire Warwickshire 7 . . 7 . 
= Belfast City Nottinghamshire 


BRAVE | Tracking on UK council websites 6 


Number of council sites that load 


196 each "RTB" data breaching company 
Google 
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34 
Council 
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Example: Council Advertising Network 
shares personal data with 22 partners 


0160306351 the data on to g orave 
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Criteo OpenX 
Collective Pubmatic 
Council 
DistrictM Advertising 0-0 
Project 
Network 
EMX Quantcast 
Google RhythmOne 
GroupM Sonobi Sovrn Sublime Skinz PulsePoint Teads 


Real-Time Bidding: the 
UK's worst data breach 


Many councils use “RTB” online advertising auctions to run 
ads on their websites. This is an enormous data breach, 
exposing people to profiling by innumerable companies, 
billions! of times a day. 


The findings: 


e More than half of council websites use “real-time bidding” (RTB) 
ad auctions. RTB faces multiple GDPR investigations for 
systematic data breaches, because it broadcasts people's 
personal data to countless companies. 


e Often, this information is extremely sensitive: it can include 
unique ID codes to identify who is loading the page, their 
location, interests, and what they are reading or watching.? These 
data can be tied together over time to build detailed profiles. 


e 196 council websites use Google's RTB system. Google's RTB 
shares data with hundreds of companies, without any assurance 
of who that data is then shared with or how it will be used. 


e  34councils use the Council Advertising Network. It shares 
people's profile data with 22 other businesses including Google.4 


Reg U | ato ry fa | | u re tO 198 Councils use “real-time bidding” 


advertising on their sites 
0 rot e Ct t h e U K a g a | nN ST RT R 16166510 untan couneis English non-metropolitan county councils 


Real-time bidding is the biggest data breach ever 
recorded in the UK.! Though illegality is not in dispute, 


the UK's privacy regulator (the ICO) has failed to act. 
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: Councils without real-time bidding 
2 B Councils with real-time bidding 
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Timeline of ICO inaction: 


e January 2018 The ICO is contacted by Dr Johnny Ryan, then 
an industry whistle blower, about the RTB data breach. 


wi 


e September 2018 Brave initiates a campaign of formal GDPR 
complaints to stop the RTB data breach. The ICO receives 
Brave's evidence in GDPR complaints from Jim Killock of the 
Open Rights Group and Dr Michael Veale. 


ej 
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e June 2019 The ICO announces that RTB is currently unlawful, 
and gives the industry six months to clean up. 


e December 2019 The ICO's six month grace period for the RTB 
industry ends. No substantive action is proposed by industry. 


- 
e January 2020 The ICO announces it accepts the RTB industry's 
gestures, and will take no immediate action to stop the 


continuing RTB data breach. 


Information Commissioner's Office 
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Number of data brokers discovered on council websites 


MENOS Quantcast C bluekal d eyeota 
á SSLOTAME  TRUOPTIK 


Former ly Acxiom 


Data Brokers are listening 


Data brokers build dossiers of information about people in 
order to sell information about them. This is a shadowy 
industry, and there is little transparency about how 
information about you is used, or by whom. 


The findings: 


e 23 council websites allow data broker companies to learn about 
what a person does when they visit their site. This can reveal very 
sensitive characteristics about a person's financial circumstances, 


and health. 


e 8 councils allow five or more data brokers to profile people 
visiting their websites. 


e  liveRamp, a data broker, is active on 9 council websites. Until 
recently it was part of the Acxiom Group, which sold data to 
Cambridge Analytica. These councils serve 6.9 million people. 


e  LiveRamp claims to have profiles of 67% of the entire UK 
population (over 45 million people), "based on touchpoints from 
the real world that are ... tied with online identifiers”. 
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Social tools and plug-ins on council sites 


89 


Twitter 
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52 
Facebook 
23 

YouTube 

(Google) 11 
AddThis 10 
(Oracle) Other 


ShareThis 


Example: AddThis share buttons 


Step 1. Step 2. Step 3. 
Person visits a AddThis share AddThis shares data 
Council webpage. buttons load. with data broker. 


" AddThis" is a free tool for websites to let their users share on social 
networks. It is owned by Oracle, a data broker.” WY brave 


Share buttons that spy 


Facebook, Twitter, and many other companies are able to 
learn about people because of social sharing buttons that 
appear on council websites. 


The findings: 


More than a third (38926) of council sites have a social plug-in 
that tells social platforms or "audience research" companies 
what people are reading. 


89 council websites use Twitter tools that leak people's 
behaviour on their sites to the social platform. These councils 
serve 19 million people. 


52 council websites use Facebook tools. These councils serve 
14.2 million people. 


23 council websites are using YouTube, potentially exposing 
5.7 million people to Google. 


In addition, other social tools are on 50 council websites. 


UJ 
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Vague text about “improving 
your browsing experience”. 


We use cookies to improve your browsing experience. You can customise your cookie p 


your consent at any time, please visit our Privacy notice. 


wî Necessary m Preferences p Statistics [| Marketing Show details 


No indication of what is happening to the 


data, even if one clicks for more information. 


11 


The options are pre-ticked default. 


| X 
Cookie Preferences 
A 


No immediately visible way to opt-out 


The consent scam 


The consent requests shown on many council websites 
purport to comply with the GDPR, but are in reality an 
attempt to obfuscate what is really happening to the 
visitor’s data. In any case, the user’s answer was generally 
ignored. 


The findings: 


e Despite no consent button being clicked, data collecting 
companies continued to process personal data. 


©» The consent system used by these companies has no effective 
auditing that ensures the data are not misused. The UK 
Information Commissioner says it is “insufficient to provide for 
free and informed consent"? 


e The data leakage revealed in this report is a “data breach” 
under Article 5(1)f of the GDPR. Personal data must be protected 
“against unauthorised or unlawful processing and against 
accidental loss, destruction or damage, using appropriate 
technical or organisational measures”. This makes it impossible to 
correctly obtain or give consent. 
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Enfield London Borough Council 
financial assistance and emergency support page 


٥۵م‎ 
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BidSwitch BlueKai Council Advertising Index Exchange 
RTB broadcast Data broker Network RTB broadcast . 
AppNexus RTB broadcast Adyoulike 
RTB broadcast N \ / RTB broadcast 
© © © 4 Extrahelpwithrentand Counc! x — 4- 
c û new.enfield.gov.uk/services/t fits/discretionary-payments/#es x © i 
Avocet le use cookies to improve your browsing experience. . You can customise your cookie pre ferences usin g the check boxes below. To chan: ge or withdraw 
your consent at a! notice. 
RTB broadcast XN Ea 


OpenX 


OM iow details 
mer Premium Service ت‎ pae 
and Great Cars ee RTB broadcast 


| select Languagev Accessibility Register |Login Newsletters 
Criteo E 
"Retargeter" E © DUE 2 d 8 | J) K b MIN B E 0 8 5 fU WX ١ 
Home / Services / Benefits / Extra help with rent and Council Tax 
M Extra help with rent and Council Tax ار نت‎ 
aad roadcast 
i Tax only 


Lot a m e If you receive Housing Benefit, Universal Credit housing costs or Council Tax Support and still have difficulty paying your rent or 
Data broker 


You can apply for a DHP if you get Housing Benefit or Universal Credit housing costs and think that you need extra help paying your 
سے‎ rent. Quantcast 


Before applying, you should tell us or the Jobcentre about your current situation to receive the correct payments. The DHP Fund is 
5 " limited so we will look at your income and expenses to make a decision. Data broker 

D l st ri ct m You may need to give evidence of: 

. attempts you have made to improve your situation (moving to an a ffordable home, negotiating rent re duction or payments 
RTB broadcast wh your land s 

* Steps you took to maximise your income by claiming all benefits you are entitled to or seeking help with debts and money 

management 

. money you get and spend (bank statements within the last two months and savings accounts ) 

٠ rent arrears (rent statement, bank statement, rent book or rent receipts) 

. anyone who lives with you who has the ability to give financial help 

٠ notice to leave your home 

LiveRamp 
G oogle If you receive al Credit you must also provide the following: 

broad Data broker 
RTB broadcast hs Universal 
and more 
give y n get i f yq 
TruOptik Rubicon Project 
Data broker RTB broadcast 
Eyeota Facebook GeoEdge Media Math 
Data broker Social network Profiler for Data broker 
antifraud 


Profiling you as a “Budgeter 
on benefits” 


Some councils allow data brokers, advertising technology 
companies, and other private firms to profile financial 
distressed citizens. 


Example: Enfield London Borough Council financial assistance 
page. 


e This page is for people who need financial support for 
accommodation and food. Enfield London Borough 
Council serves 333,869 people. 


e 11 advertising auction companies, including Google, 
broadcast data about visitors to this page to tens or hundreds 
of business partners. 


e The “Council Advertising Network” uses visits to pages like 
this to profile people as "Budgeters on benefits”.? It claims an 
audience of 875,000 unique individuals from low income 
families on council websites per month. 


e Among the 21 data collecting companies that track visitors to 
this page, 7 are data broker companies whose business model 
is to sell profile data about people to other companies. 


brave 
Sheffield City Council 
“Drugs & alcohol support” page 


9 brave 
LiveRamp Rubicon Project Sizmek TruOptik 
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RTB broadcast Profiler for 
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Ad network 
Media Math 
Data broker 

Bidswitch 

RTB broadcast Drugs & alcohol support OpenX 
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Retargeter Data broker RTB broadcast Data broker 
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Data companies know 
who is an alcoholic 


Citizens are subject to extensive profiling by shadowy data 
companies even when they visit highly sensitive pages on 
some council websites. 


Example: Sheffield City Council drugs & alcohol support page 


e This page is for people seeking support for substance abuse. 
Sheffield City Council serves 582,506 people. 


e Sheffield City Council enables at least 20 data collecting 
companies to receive data about people visiting this highly 
sensitive page. 


e This includes 8 data brokers. These are companies whose 
business model is to profile people and sell data about them to 
other companies. 


e ln addition, 9 advertising auction companies, including Google, 
leak profile data about the person reading this webpage, through 
"RTB" broadcasts. 
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Ealing London Borough Council 
“Special educational needs and disability” page 


21 data collectors 
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BidSwitch BlueKai Council Advertising Index Exchange 
RTB broadcast Data broker Network RTB broadcast 


AppNexus RTB broadcast Adyoulike 
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OpenX 
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ildren and families / Special educational needs and disability 


Home 
"ےت ۾‎ All local authorities in the UK are required to publish information about education, health 
and social i 0 


0 ial care services available in their area for children and young people (0-25 years 
old) who have special educational needs and/or disabilities (SEND). This is called the 
"Local Offer'. 


^ | The Local Offer: Related information B ————a Qu antcast 


* gives information about education, health and family support services 
SEND appeal Data broker 


Lotame 
Data broker 


* gives information about leisure activities and support groups 


Districtm 


* makes service provision more responsive to local needs and aspiration 


RTB b roa d cast * will be developed and reviewed with service users and service providers 


GEC 
The Local Offer is for: 2nd Grade 
* children and young people with SEN and/or disabilities (SEND) from 0-25 years 
rade 
* parents and carers 


+ practitioners and professionals 4th Grade 


Google LiveRamp 


aling's Local Offer 
E یں‎ Ealing's Local O CETE Data broker 
roadcast Building My Future Programme 6th Grade 
and more 027 × 


TruOptik Rubicon Project 
Data broker RTB broadcast 


Eyeota Facebook GeoEgde Media Math 
Data broker Social network Profiler for Data broker 
antifraud 


Targeting disabled children 
and their parents 


Data collectors are able to snoop on people reading about 


their child's disability on some council websites. 


Example: Ealing London Borough Council “special educational 
needs and disability” page. 


e This page contains information to help young people aged 
11-25 years. Ealing London Borough Council serves 341,982 
people. 


e Atleast 21 data collecting companies are allowed to snoop 
on a person who loads this page. This includes 7 data brokers 
and 12 advertising auction companies. 


e This is particularly alarming because the page concerns the 
welfare of vulnerable children. 


e The Council Advertising Network claims to have a "disability" 
audience of 1 million unique individuals per month on council 
websites.!! 


How to protect yourselt 


Brave is a new, private web browser. It (€ 9 © O Welcome to Brave x + 
brings unmatched speed and battery life. و5۸۵‎ rn oos 9 2 ہب‎ 
And it also blocks data-grabbing ads and 

trackers. 


10 million people use Brave to make the 
web quicker and safer. You can download 
it for your phone or computer at 
Brave.com and browse the web with 
confidence. Brave the new Internet 


Get ready to enjoy a faster and more secure browsing 
Brave's CEO is Brendan Eich, inventor of experience with a browser built to protect your privacy. 
JavaScript, and co-founder of Mozilla/ 


Firefox 


Skip welcome tour © © © © © © 


Read about Brave's campaign to stop the 
RTB data breach at brave.com/rtb-updates/ 
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End notes: 


For the scale of the RTB data breach see evidence gathered for 


regulators by Brave (URL: https://brave.com/wp-content/ 
uploads/2019/07/Scale-billions-of-bid-requests-per-day- 


RAN2019061811075588.pdf). 

See details of investigation of Google and IAB real-time bidding 
systems by Irish and Belgian GDPR regulators at "Updates & 
timeline for Brave's work to fix "RTB" adtech", Brave (URL: 
https://brave.com/rtb-updates/). 

Two technical documents specify what personal data are 
broadcast by the real-time bidding system. See"RTB 3.0, 
AdCOM v1.0", IAB Tech Lab, November 2019 (URL: https:// 
github.com/InteractiveAdvertisingBureau/AdCOM/blob/master/ 
AdCOM?620v1.09620FINAL.md); and "Authorized Buyers Real- 
Time Bidding Proto v.169", Google (URL: https:// 


developers.google.com/authorized-buyers/rtb/realtime- 
bidding-guide). 

The Council Advertising Network lists its advertising partners in 
"CAN Privacy Policy", Council Advertising Network (URL: 
https://can-digital.net/can-privacy-policy/). 

Brittany Kaiser's slidedeck at 54:16, in "The Great Hack" (2019). 
"Identity Graph: Connecting Data for Better Customer 
Relationships", LiveRamp (URL: https://liveramp.uk/our- 
platform/identity-graph/). 

Oracle uses this data to enable "Oracle Marketing & Data Cloud 
customers and partners to market products and services to you". 
See "AddThis Privacy Policy", Oracle (URL: https:// 


www.oracle.com/legal/privacy/addthis-privacy- 
policy.htmHtresponsible). 

"Adtech Report", Information Commissioner's Office, June 2019, 
p. 23 (URL: https://ico.org.uk/media/about-the-ico/documents/ 
2615156/adtech-real-time-bidding-report-201906.pdf). 

"CAN Premium", Council Advertising Network (URL: https://can- 


digital.net/can-premium/) 


"Budget conscious DM", Council Advertising Network media 


pack, p. 12 (URL: https://can-digital.net/can-media-pack/). 
"Disability", ibid., p. 10. 


1. 
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Caveat 1: focus on risk 


This is not a complete study. Third party tools commonly used by 
websites for chat bots, designing the page, soliciting email 
subscription, profiling visitors for the Council's own user data base, 
text to speech, CDN, fonts, non-Google analytics, etc. are not 
counted in this study. (See "table notes" on page 20 for a list of 
what is counted). 


While these do expose a user's behaviour to the companies 
concerned, we exclude them here in order for simplicity. This study 
highlights what we view as the most dangerous third party data 
collection and profiling. 


Caveat 2: the problem is likely to be more acute than this 
report indicates 


The number of third party data collectors in this study should be 
understood as a floor, or a minimum, for three reasons. 


First, only the landing page of each site was measured, and the 
page was not interacted with the way actual web users would 
interact with the site. Normal web users who visit more pages (and 
click on consent buttons) may encounter more trackers. 


Second, what is measured here are "known knowns". Online 
tracking is an extremely quickly moving space, with trackers 
constantly trying to avoid detection through a wide variety of 
methods. There are tracking scripts and parties operating on the 
web that have not been identified yet, and that are not counted 
here. 


Third, this study examined only the data collection that is visible to 
one's own computer. It does not examine what might be occurring 
between company owned servers. 


The floor, therefore, is a low one. The situation is likely to be more 
acute than this report indicates. 


Methodology, caveats, and references 
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Methodology 

1. ھ‎ list of local, county, and unitary councils was collected for 
England and Wales from local.gov.uk; for Scotland from 
COSLA, and for Northern Ireland from NI Direct. 


2. A list of URLs for each website associated with each council 
was created. 


3. Population figures were collected for each council area from 


the UK Office for National Statistics, and from Dorset Council. 


4. Mapping data was collected for each council area at local 
administrative district level, and at county region level, from 


data.gov.uk. and the UK ordinance survey. 


5. Tim Libert’s webxray tool was used. 
a. Tim Libert's third party detection list was supplemented 
with additional trackers known to Brave. 
b. Webxray was set to visit each site for 30 seconds. 
. No consent requests were accepted. 
d. In late December 2019, statistics were collected by 
webxray about items loaded from third party domains. 


O 


6. Results from each URL were cross referenced with population 
figures, and mapped. Some councils serve several areas, and 
some sites serve more than one administrative area. 
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Appendix: tables 


Area Total Real-time bidding Other adtech Verification | Data brokers Social Google systems Area Total Real-time bidding Other adtech Verification Data brokers Social Google systems 
Aberdeen City 4 1 4 Buckinghamshire 3 1 3 
Aberdeenshire 1 1 Burnley 4 1 4 
Adur 1 1 Bury 4 4 
Allerdale 24 10 3 2 7 5 Caerphilly 4 1 3 
Amber Valley 5 1 5 Calderdale 4 1 4 
Angus 4 1 3 Cambridge 3 3 
Antrim and Newtownabbey 6 1 1 5 Cambridgeshire 4 1 4 
Ards and North Down 5 1 5 Camden 6 1 1 5 
Argyll and Bute 3 3 Cannock Chase 3 3 
Armagh City, Banbridge and Craigavon 2 2 Canterbury 2 2 
Arun 4 1 4 Cardiff 4 1 3 
Ashfield 6 1 1 5 Carlisle 5 2 3 
Ashford 6 1 1 5 Carmarthenshire 2 1 2 
Aylesbury Vale 4 1 4 Castle Point 2 2 
Babergh 5 1 1 4 Causeway Coast and Glens 5 1 5 
Barking and Dagenham 3 1 3 Central Bedfordshire 5 1 5 
Barnet 5 1 1 4 Ceredigion 4 4 
Barnsley 2 2 Charnwood 4 1 4 
Barrow-in-Furness 3 3 Chelmsford 6 1 1 5 
Basildon 6 1 1 5 Cheltenham 3 3 
Basingstoke and Deane 4 4 Cherwell 3 3 
Bassetlaw 2 2 Cheshire East 6 1 2 4 
Bath and North East Somerset 4 1 4 Cheshire West and Chester 3 1 3 
Bedford 3 3 Chesterfield 5 1 1 4 
Belfast 7 1 1 1 5 Chichester 1 1 
Bexley 6 1 1 2 4 Chiltern 4 1 3 
Birmingham 4 1 4 Chorley 1 1 
Blaby 4 4 Christchurch 2 2 
Blackburn with Darwen 3 3 City of Edinburgh 5 1 5 
Blackpool 5 1 4 City of London 2 1 2 
Blaenau Gwent S 1 3 Clackmannanshire 2 2 
Bolsover 4 1 4 Colchester 5 1 5 
Bolton 4 4 Conwy 2 1 1 
Boston 4 4 Copeland 1 1 
Bournemouth, Christchurch and Poole 4 1 1 3 Corby 3 1 2 
Bracknell Forest 3 3 Cornwall 4 1 4 
Bradford 6 2 4 Cotswold 4 1 4 
Braintree 4 1 4 County Durham 3 3 
Breckland 6 1 1 5 Coventry 5 1 5 
Brent 5 1 5 Craven 1 1 
Brentwood 1 1 Crawley 2 2 
Bridgend 4 1 3 Croydon 12 6 1 1 6 
Brighton and Hove 4 4 Cumbria 5 1 1 4 
Bristol, City of 3 3 Dacorum 5 1 5 
Broadland 3 3 Darlington 3 1 2 
Bromley 5 1 5 Dartford 1 1 
Bromsgrove 13 3 3 1 1 1 7 Daventry 3 3 
Broxbourne 6 1 1 6 Denbighshire 7 1 1 2 5 
Broxtowe 3 3 Derby 4 1 4 
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Appendix: tables 


Area Total Real-time bidding Other adtech Verification Data brokers Social Google systems Area Total Real-time bidding Other adtech Verification Data brokers Social Google systems 
Derbyshire 4 4 Gosport 3 1 2 
Derbyshire Dales 16 3 4 1 1 3 7 Gravesham 4 4 
Derry City and Strabane 5 1 5 Great Yarmouth 4 1 4 
Devon 2 1 2 Greenwich 4 4 
Doncaster 4 1 4 Guildford 4 2 3 
Dorset 3 1 3 Gwynedd 4 4 
Dover 5 1 5 Hackney 6 3 4 
Dudley 4 1 4 Halton 13 3 3 1 1 1 7 
Dumfries and Galloway 6 1 1 4 Hambleton 4 1 4 
Dundee City 5 2 3 Hammersmith and Fulham 6 3 4 
Ealing 23 10 2 1 7 6 Hampshire 5 1 5 
East Ayrshire 1 1 Harborough 6 1 1 4 
East Cambridgeshire 4 1 4 Haringey 5 2 1 3 
East Devon 1 1 Harlow 2 2 
East Dorset 3 1 3 Harrogate 4 1 4 
East Dunbartonshire 3 1 2 Harrow 2 2 
East Hampshire 5 1 1 4 Hart 2 1 1 
East Hertfordshire 3 3 Hartlepool 4 1 4 
East Lindsey 4 1 3 Hastings 3 3 
East Lothian 4 4 Havant 6 1 1 5 
East Northamptonshire 4 1 4 Havering 6 2 5 
East Renfrewshire Herefordshire, County of 7 1 1 1 6 
East Riding of Yorkshire 5 1 5 Hertfordshire 3 3 
East Staffordshire 4 4 Hertsmere 5 1 4 
East Sussex 3 3 High Peak 5 1 4 
Eastleigh 7 1 1 1 5 Highland 5 1 5 
Eden 1 1 Hillingdon 4 1 4 
Elmbridge 3 3 Hinckley and Bosworth 3 3 
Enfield 25 11 2 1 7 1 6 Horsham 4 1 4 
Epping Forest Hounslow 3 3 
Epsom and Ewell 2 2 Huntingdonshire 5 1 5 
Erewash 5 2 3 Hyndburn 3 3 
Essex 5 1 5 Inverclyde 2 2 
Exeter 2 2 loswich 1 1 
Falkirk Isle of Anglesey 

Fareham 1 1 Isle of Wight 4 1 4 
Fenland 2 2 Isles of Scilly 2 2 
Fermanagh and Omagh 5 1 5 Islington 2 2 
Fife 3 3 Kensington and Chelsea 1 1 

Flintshire 1 1 Kent 5 1 1 4 
Folkestone and Hythe 6 1 1 5 Kettering 4 4 
Forest Heath 4 4 King's Lynn and West Norfolk 2 2 
Forest of Dean 4 1 4 Kingston upon Hull, City of 1 1 
Fylde 3 3 Kingston upon Thames 7 2 1 1 4 
Gateshead 6 1 1 5 Kirklees 4 4 
Gedling 5 1 5 Knowsley 1 1 
Glasgow City 1 1 Lambeth 6 1 1 5 
Gloucester 5 1 4 Lancashire 11 3 2 1 1 2 3 
Gloucestershire 8 1 1 2 6 Lancaster 7 1 2 5 
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North Lincolnshire 
North Norfolk 

North Somerset 
North Tyneside 
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North West Leicestershire 
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Northampton 
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Northumberland 
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Nottingham 
Nottinghamshire 
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Oadby and Wigston 
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Orkney Islands 
Oxford 

Oxfordshire 
Pembrokeshire 
Pendle 

Perth and Kinross 
Peterborough 
Plymouth 

Poole 

Portsmouth 

Powys 

Preston 

Purbeck 

Reading 

Redbridge 

Redcar and Cleveland 
Redditch 

Reigate and Banstead 
Renfrewshire 
Rhondda Cynon Taf 
Ribble Valley 
Richmond upon Thames 
Richmondshire 
Rochdale 

Rochford 

Rossendale 

Rother 

Rotherham 
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Leeds 

Leicester 
Leicestershire 

Lewes 

Lewisham 

Lichfield 

Lincoln 

Lincolnshire 

Lisburn and Castlereagh 
Liverpool 

Luton 

Maidstone 

Maldon 

Malvern Hills 
Manchester 

Mansfield 

Medway 

Melton 

Mendip 

Merthyr Tydfil 

Merton 

Mid and East Antrim 
Mid Devon 

Mid Suffolk 

Mid Sussex 

Mid Ulster 
Middlesbrough 
Midlothian 

Milton Keynes 

Mole Valley 
Monmouthshire 
Moray 

Na h-Eileanan Siar 
Neath Port Talbot 
New Forest 

Newark and Sherwood 
Newcastle upon Tyne 
Newcastle-under-Lyme 
Newham 

Newport 

Newry, Mourne and Down 
Norfolk 

North Ayrshire 

North Devon 

North Dorset 

North East Derbyshire 
North East Lincolnshire 
North Hertfordshire 
North Kesteven 
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Stratford-on-Avon 
Stroud 

Suffolk 

Suffolk Coastal 
Sunderland 
Surrey 

Surrey Heath 
Sutton 
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Swansea 
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Tameside 
Tamworth 
Tandridge 
Taunton Deane 
Taunton Deane 
Teignbridge 
Telford and Wrekin 
Tendring 

Test Valley 
Tewkesbury 
Thanet 

Three Rivers 
Thurrock 
Tonbridge and Malling 
Torbay 

Torfaen 

Torridge 

Tower Hamlets 
Trafford 
Tunbridge Wells 
Uttlesford 

Vale of Glamorgan 
Wakefield 
Waltham Forest 
Wandsworth 
Warrington 
Warwick 
Warwickshire 
Watford 
Waveney 
Waverley 
Wealden 
Wellingborough 
Welwyn Hatfield 
West Berkshire 
West Devon 
West Dorset 
West Dunbartonshire 
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Rutland 

Ryedale 

Salford 

Sandwell 
Scarborough 
Scottish Borders 
Sedgemoor 
Sefton 

Selby 

Sevenoaks 
Sheffield 

Shetland Islands 
Shropshire 

Slough 

Solihull 

Somerset 
Somerset West 
South Ayrshire 
South Bucks 

South Cambridgeshire 
South Derbyshire 
South Gloucestershire 
South Hams 

South Holland 
South Kesteven 
South Lakeland 
South Lanarkshire 
South Norfolk 
South Northamptonshire 
South Ribble 
South Somerset 
South Staffordshire 
South Tyneside 
Southampton 
Southend-on-Sea 
Southwark 
Spelthorne 

St Albans 

St Edmundsbury 
St. Helens 

Stafford 
Staffordshire 
Staffordshire Moorlands 
Stevenage 

Stirling 

Stockport 
Stockton-on-Tees 
Stoke-on-Trent 
Strabane 
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Area Total Real-time bidding Other adtech Verification Data brokers Social Google systems 
West Lancashire 8 1 3 4 
West Lindsey 5 1 5 
West Lothian 3 8 
West Oxfordshire 4 1 4 
West Suffolk 4 4 
West Sussex 3 3 
Westminster 4 1 3 
Weymouth and Portland 3 1 3 
Wigan 4 1 1 3 
Wiltshire 3 3 
Winchester 4 1 4 
Windsor and Maidenhead 5 1 5 
Wirral 22 10 2 1 7 5 
Woking 1 1 
Wokingham 3 3 
Wolverhampton 3 3 
Worcester 4 1 4 
Worcestershire 4 1 4 
Wrexham 14 3 4 1 1 1 6 
Wychavon 4 1 4 
Wycombe 4 1 3 
Wyre 4 1 3 
Wyre Forest 2 2 
York 5 1 4 
Area Notes 
Vale of White Horse Website failed to load 
South Oxfordshite Website failed to load 

Table notes 

“Total” refers to the combined number of companies from each "Verification" includes GeoEdge, Integral Ad Science, Moat. 

category. Although MediaMath and YouTube are each in two 

categories, they are not double counted in the “total” column. As a “Data brokers” includes Blue Kai, Eyeota, LiveRamp, Lotame, 

result, the number in the total column may be lower than the sum of MediaMath, Quantcast, TruOptik. 


the other columns. 
“Social / research” includes AddThis, AddToAny, Disqus, Flickr, 


“Real-time bidding” includes AdRoll, AppNexus, Avocet, BidSwitch, Scorecard Research, ShareThis, Linkedin, Twitter, Facebook, Instagram, 
Bizo, Council Advertising Network, DoubleClick (“Authorized Buyers”), YouTube. 

IndexExchange, MediaMath, One by AOL, OpenX, PubMatic, Rubicon 

Project, TripleLift, Adyoulike. “Google” includes AdSense, Google, Google Analytics, Google API, 


Google Tag Manager, Doubleclick (“Authorized Buyers”), YouTube. 
“Other adtech” includes AdSense, Amazon Marketing, AWIN, OneTag, 
Criteo, Outbrain, Taboola. 


